CDW enhances security and compliance internally and for its customers with PAM

CDW is a leading provider of technology solutions and services for business, government, education and healthcare. Ranked No. 32 on Forbes’ list of America’s Largest Private Companies, CDW’s key focus areas include software, network communications, notebooks/ mobile devices, data storage and solutions such as virtualization, collaboration, security, mobility, data center optimization and cloud computing. When providing services that require privileged access CDW requires credentials to access remote systems at the customer site, as well as systems under a hosting model, where they need to access their customers systems that are collocated in a CDW datacenter

• Annual Revenue: USD 18.47 billion
• Employees: 10,000+

Challenges

Privileged Access Manager Solution Transforms Credential Management And Meets A Range Of Audit Requirements

With a growing managed services business and increasing responsibility for its customers’ technology infrastructure, the company needed a solution to better manage and store system passwords and user credentials in a way that would also meet audit and compliance requirements – for both CDW and its customers.

Solutions

For CDW, managed services is not just about ensuring an application is up and running, in many cases the company acts as a de facto IT department with responsibility for operating systems and infrastructure including email servers, credit card processing systems, mission critical network devices and personal health information systems.

Every time CDW implements a service for one of its customers, it generates a batch of credentials, traditionally a highly manual, time-consuming process it had relied on a homegrown solution to manage. Each endpoint – the appliance installed at a customer site – needs specific, unique credentials for system monitoring, alerting, and performing backups. Essentially a privileged credential is needed for accessing the customer’s servers or running service accounts.

Additionally, the customer and its partners need to be sure that the information they are accessing on those servers is secure. CDW chose the CyberArk Privileged Access Manager Solution to improve the way it handles those credentials as well as the more than 25,000 device passwords across hundreds of customers.

CDW uses the CyberArk solution to store, rotate and provision passwords to the systems it manages for customers, including credentials to root accounts and Active Directory.

Based on its broad customer base that includes e-commerce, retail and catalog organizations, the company submits to third-party formal external assessments each year including PCI, SSAE-16 (the SAS 70 replacement) and HIPAA. It also performs a self-assessment for NIST 800-53.

With the CyberArk solution, CDW can demonstrate to auditors that appropriate controls were in place and that credentials were being managed appropriately.

“CDW must continuously demonstrate that it can support and manage IT solutions in highly regulated environments and that we can work in a compliant manner,” Jason Owens, Manager IT Governance and Information Security, CDW – Managed Services. “Given CDW’s rapidly growing customer base, we needed a solution to automate credential management as well as reporting. It wasn’t about just finding a vendor to help us manage passwords, we need to provide evidence that our process was managed correctly, and with appropriate controls. CyberArk enabled us to quickly demonstrate compliance with a range of regulations with a relatively low capital investment.”

Results

CyberArk’s Innovative Technology And Flexibility Supports CDW’s Evolving Business Needs

Through automation, CDW has reduced the time required to change passwords for their Windows and Unix environments from hours to seconds. It has also greatly decreased the amount of time to get customers up and running by relying on CyberArk’s auto discovery capabilities to quickly load credentials.

“The CyberArk web interface is intuitive and easy to use, making it simple for internal users and external partners to benefit. Additionally, with relatively little training, we are able to set up new customers quickly and painlessly,” said Owens.

With a secure repository to store the credentials and a system that would make managing the credentials easier, with CyberArk, CDW gained a solution that was flexible enough to support its growing business needs, while being accessible by numerous business divisions including field services, managed services and hosting services, in a secure, auditable way.

“The structure and design of the CyberArk Privileged Access Manager Solution, including support for multiple computing platforms, has enabled us to easily adapt its use, add functionality and expand adoption based on our evolving business needs,” added Owens. “CyberArk has consistently demonstrated value across key features and functionality that improves our ability to sell more competitively and compete on exceptional security and accountability providing our customers with real benefits, including compliance and peace of mind.”

CyberArk helps CDW manage policies associated with separation of duties across credentials and, if a breach occurs, narrow down forensic details about when the access occurred, what systems were accessed, and by whom.

“With our previous propriety system, meeting audit requirements was an arduous process. Without CyberArk, it would have taken ten times as much effort to justify. CyberArk has been instrumental in CDW maintaining and sustaining compliance.”

– Jason Owens, Manager IT Governance and Information Security, CDW – Managed Services

Key benefits

• Enterprise solution to manage privileged access in 25k+ devices and systems across hundreds of customers.
• Automation reduced the time required to change passwords from hours to seconds
• Ongoing compliance across a variety of regulations providing proof to auditors that privileged accounts are under control
• Decreased the amount of time to get customers up and running with the ability to quickly provision credentials
• Supported expanded managed services business and attain a competitive advantage
• Visibility from a compliance and governance perspective regarding credentials management
• Secure repositories to store sensitive critical documents